Skydive uses the Gremlin traversal language as a topology and flow request language.
Requests on the topology can be done as following :
Refer to the Gremlin section for further explanations about the syntax and the functions available.
A typical Gremlin request on Flows will return a JSON version of the Flow structure.
The Flow Schema is described in a protobuf file .
The following command starts a capture on all docker0 interfaces :
The Gremlin expression is continuously evaluated which means that it is possible to define a capture on nodes that do not exist yet. It useful when you want to start a capture on all OpenvSwitch whatever the number of Skydive agents you will start.
While starting the capture, you can specify the capture name, capture description and capture type optionally.
At this time, the following capture types are supported :
ovssflow, for interfaces managed by OpenvSwitch such as OVS bridges
afpacket, for interfaces suchs as Linux bridges, veth, devices, …
pcap, same as
sFlow, Socket reading sFlow frames
dpdk, for interfaces managed by DPDK
pcapsocket. This capture type allows you to inject traffic from a PCAP file.
ovsmirror, leverages OpenvSwitch port mirroring.
eBPF, flow capture within kernel
Delete a capture
If the flow probe
pcapsocket is enabled, you can create captures with the
pcapsocket. Skydive will create a TCP socket where you can copy PCAP
nc for instance). Traffic injected into this socket will have
its capture point set to the selected node. The TCP socket address can be
retrieved using the
PCAPSocket attribute of the node or using the
PCAPSocket attribute of the capture.
Skydive provides a Packet injector, which is helpful to verify the successful packet flow between two network devices by injecting a packet from one device and capture the same in the other device.
Create packet injector
To use the packet injector we need to provide the below parameters,
- Source node, needs to be expressed in gremlin query format.
- Destination node, needs to be expressed in gremlin query format, optional if dstIP and dstMAC given.
- Source IP of the packet, optional if source node given.
- Source MAC of the packet, optional if source node given.
- Destination IP of the packet, optional if destination node given.
- Destination MAC of the packet, optional if destination node given.
- Type of packet. currently ICMP, TCP and UDP are supported.
- Number of packets to be generated, default is 1.
- IMCP ID, used only for ICMP type packets.
- Interval, the delay between two packets in milliseconds.
- Source port, used only for TCP and UDP packets, if not given generates one randomly.
- Destination port, used only for TCP and UDP packets, if not given generates one randomly.
Delete packet injection
Deleting the active packet injector can be done by using the
delete sub-command with the UUID of the injector.
UUID of the injection will be returend as a response of
Skydive allows you to create alerts, based on queries on both topology graph and flows.
- a non empty string
- a number different from zero
- a non empty array
- a non empty map
The alert is triggered only if the evaluation result differs from the previous evaluation.
With the following command, the alert is triggered as soon as the Gremlin query returns something new (i.e. a new node returned by the query, an updated metadata in the returned nodes…).
With the following command, the alert is triggered when the bandwidth of the flow bypass 1Mbps. It gets trigerred again the next time the bandwidth bypass this threshold.
Name, the alert name (optional)
Description, a description for the alert (optional)
Action, URL to trigger. Can be a local file or a WebHook
Trigger, event that triggers the alert evaluation. Periodic alerts can be specified with
duration:5s, for an alert that will be evaluated every 5 seconds.
When an alert is triggered, all the WebSocket clients will be notified with a
message of type
Alert with a JSON object with the attributes:
UUID, ID of the triggered alert
Timestamp, timestamp of trigger
ReasonData, the result of the alert evaluation. If
expressionis a Gremlin query, it will be the result of the query. If
In addition to the WebSocket message, an alert can trigger different kind of actions.
A POST request is issued with the JSON message as payload.
A local file (prefixed by file://) to execute a script. It receives the JSON message through stdin